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Information Commissioner's Office 


The Information Commissioner’s Office response to the 
Scottish Government’s consultation on Transforming 
Parole in Scotland 


Introduction 


1. The Information Commissioner’s Office (ICO) is pleased to respond to the 
Scottish Government’s consultation on transforming parole in Scotland. 


2. The ICO has responsibility for, amongst other things, promoting and 
enforcing the EU General Data Protection Regulation (GDPR) and the UK 
Data Protection Act 2018 (DPA). 


3. The ICO is independent of government and upholds information rights in the 
public interest, promoting openness by public bodies and data privacy for 
individuals. The ICO does this by providing guidance to individuals and 
organisations, solving problems where we can, and taking appropriate action 
where the law is broken. 


4. In the case of a judicial body, such as the Parole Board for Scotland, UK data 
protection law will apply. However, the ICO is not permitted to regulate the 
processing of personal data by individuals, courts or tribunals when acting in 
their judicial capacity.! 


5. As the regulator of data protection law in the UK, our response is focussed 
on those questions which address issues relating to an offender’s personal 
information and their information rights. While many of these rights are 
qualified, it is for the Government in drafting any new legislation, and for the 
Parole Board in carrying out its functions, to ensure that robust balancing 
tests on the rights and interests of the various parties has been conducted. 


Consultation with the ICO 


6. Article 28(2) of the EU’s Law Enforcement Directive on protection of personal 
data states that Member States shall provide for the supervisory authority to 
be consulted when developing proposals for legislation to be passed by the 
national parliament, or regulatory measures based on such legislation, 
relating to the processing of personal data. 


1 Section 117, Data Protection Act 2018 
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While this obligation has not been transposed into Part 3 of the DPA, we 
would encourage the Scottish Government to act in the spirit of the Directive 
and would look forward to more detailed consultation with us as its 
proposals develop. 


Questions on strengthening the voice of victims in the 
parole process, and Questions on ensuring transparency 


Question 5: Do you think that victims and their families should receive 
information on the reasons for the Parole Board's decisions in their case? 


Question 7: Should information be routinely shared with others? 


8. 


10. 


11. 


Individuals, including offenders, have a right to privacy under article 8 of the 
European Convention on Human Rights. Any interference with this right by a 
public authority must be in accordance with law and necessary for one or 
more of the purposes specified in article 8. 


In addition, individuals have the right to protection in the processing of their 
personal data under data protection law. Where the processing by the Parole 
Board for Scotland is part of determining a person’s continued criminal 
penalty, this is governed by the rules for law enforcement processing set out 
in part 3 of the DPA. 


In determining whether to bring forward specific proposals to allow the 
Parole Board to disclose information about the offender to the victim, their 
family, to other specified persons or to the public at large by means of 
proactive publication, the Scottish Government must balance the legitimate 
interests of these other persons with the offender’s right to both privacy and 
data protection. It must therefore be clear about the purpose of disclosure to 
each category of recipient and their ‘need to know’. 


Information about decisions taken at an offender’s parole hearing would 
likely constitute information relating to a criminal offence as defined by 
article 10 of the GDPR and sections 3(2) and 11(2) of the DPA. This type of 
information can only be processed a data controller if they are exercising 
official authority or when it is authorised by law. The law must provide 
appropriate safeguards for the rights and freedoms for the offender as the 
data subject. 
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12. 


13. 


14. 


15. 


We would expect any specific proposals to include a robust analysis of why 
the current parole rules on non-disclosure and confidentiality are no longer 
fit for purpose, and what the least privacy-intrusive solution to the 
deficiency would be. 


Should the purpose and necessity for disclosure to any particular category of 
recipient be established, the Government must then ensure that the 
information to be provided is limited to what is adequate and relevant for 
that purpose. This may mean that the information provided to the recipient 
is not the same in all circumstances as that provided to the offender. The 
amount and detail of information should be tailored as far as possible to the 
interests of the recipient. In the case of any of the categories of sensitive 
personal data listed in section 35(8) of the DPA, the Government should 
ensure that the Parole Board would be able to rely on one of the conditions 
in schedule 8 of the DPA. 


The offender has the right to be informed by the Parole Board about a 
variety of matters listed in section 44 of the DPA. In particular, they are 
entitled to know about the categories of recipients of their personal 
information. If the Parole Board has any discretion in what information can 
be provided, the offender would have a qualified right to object to any 
discretionary elements of the disclosure. 


We would welcome the Government incorporating these rights into the law 
governing parole hearings. They should be supported by clear guidance and 
information for both the offender and the victim to provide the necessary 
transparency. 


Question 8: Do you feel that some information regarding parole decisions should 
be published proactively? 


16. 


17. 


We would welcome a clearer explanation of what the Government means 
here by proactive publication. This could take a variety of forms and each 
could have different data protection considerations. 


In addition to our answer to question 7, any proactive publication on a 
website will often result in a restricted transfer of personal data. The 
restricted transfer would take place when someone outside the UK accesses 
that personal data via the website. In this case, the Parole Board would also 
need to identify an appropriate international transfer mechanism under data 
protection law. It would also need to consider its duty to implement data 
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18. 


19. 


protection by design and default, including not making personal data 
available to an unlimited number of people. 


The courts have considered complaints about the uploading of personal data 
to websites and their availability online on grounds of breaches of data 
protection, most notably the Google Spain judgment of 2014.2 The UK has 
longstanding rules to allow offenders to move on from their past by limiting 
access to information about their offences. The Scottish Parliament is 
currently considering tightening those rules even further through the 
Management of Offenders Bill. Any new proposals for proactive publication of 
information about offenders at an individual level should be very carefully 
thought through to avoid unintended consequences that would undermine 
rehabilitation. 


Finally, any publication should neither intentionally or unintentionally identify 
or make it possible to identify any other person without a clear and specific 
decision to do so which is also in compliance with data protection law. 


Questions on improving support for decision-making 


Question 10: Do you think that consideration should be given to widening the 
information available to the Parole Board by establishing a function to investigate 
and collate information from other bodies? 


20. 


2i. 


22. 


The ICO does not have a view on what information should be obtained and 
from whom. However, if the Parole Board is not able to obtain sufficient 
personal data about the offender to fulfill its functions, then this should be 
addressed. 


The processing of any additional information must be both fair and lawful as 
defined in section 35 of the DPA. Any new powers granted to the Parole 
Board to obtain information about offenders must ensure that any 
investigation is limited to that which is adequate, relevant and necessary for 
the Parole Board’s functions. 


Those supplying information to the Parole Board would have their own 
responsibility to ensure that only adequate and relevant information is 


2 sr ei of 13 May 2014, Google Spain, C-131/12, EU:C:2014:317, 
curia.europa.eu/juris/liste.jsf?num=C-131/12 
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provided in response to a request from the Parole Board. The information 
must also be accurate and as up to date as is necessary. 


Questions on information for prisoners on the parole 
process 


Question 12: Do you think that more could be done to make sure that prisoners 
understand their licence conditions and the consequences of breaching them? 


23. 


24. 


25. 


Prisoners have the right under section 44 of the DPA to be informed about 
what will happen with their personal information. This will be relevant to 
licence conditions where, for example, a contracted third party may monitor 
the offender’s electronic tag, or a breach would lead to reports being sought 
from various agencies. 


If the provision of this information would be likely to prejudice any of the 
activities listed in section 44(4) of the DPA, the Parole Board could restrict 
the provision to a particular offender. However, general information should 
still be made publically available. 


When providing this information to individuals, section 52 of the DPA sets 
out that the information should be provided in a concise, intelligible and 
easily accessible form, using clear and plain language. We would also expect 
public authorities to consider their duties under the Equality Act 2010 to 
ensure that any reasonable adjustments are made to help offenders 
understand what they are being told. 


We trust this response is helpful. Should the Scottish Government require 
clarification of any of the points made, please contact us on 0303 123 1115 or by 


email at scotland@ico.org.uk. 
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